6e6ade23dbfbd642a65c28947d593d1f8c7c72899d0f09cd9e5a01c0dc9a035a

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc964bb346ba997b9bf5821cac1c8510_NeikiAnalytics.pdf
Size 3.2MB
Sample240513-shrhmscd45
SHA256 6e6ade23dbfbd642a65c28947d593d1f8c7c72899d0f09cd9e5a01c0dc9a035a
MD5 bc964bb346ba997b9bf5821cac1c8510
SHA1 85158bea6664339c5225ad0e86adeba51c5af191
SHA512 6ffcd206dffb41b1fde019c2efb04e147cc6abc84e1d038183eaa72ef18e3467d6d09efa0b117425daa09ad40f23c472918cfc7bd02b7fdd618979af905fd48a
SSDEEP 98304:wghLFXgXDXGF3sgpDaDGe7UgcGjgC6Mwhi0yIsjJB/kfEP3g/Y:wKRQTu1hC6MkyF/aY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
884	AcroRd32.exe
884	AcroRd32.exe
884	AcroRd32.exe
884	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 4312	884	AcroRd32.exe	87
PID 884 wrote to memory of 4312	884	AcroRd32.exe	87
PID 884 wrote to memory of 4312	884	AcroRd32.exe	87
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 400	4312	RdrCEF.exe	88
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89
PID 4312 wrote to memory of 1852	4312	RdrCEF.exe	89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bc964bb346ba997b9bf5821cac1c8510_NeikiAnalytics.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=75A74A6D4FD3BB53983B4C0CA143FF31 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:400
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9E7540939FB26DFA17AFEA18507C6786 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9E7540939FB26DFA17AFEA18507C6786 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1852
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5EE255934FD6ABFA50E6DB9744C8B264 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4456
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CB86740669DC64B84AFD5F3FE5C6D69B --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1948
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D2D6E9181ABC3251E2F76A3CA1962E61 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D2D6E9181ABC3251E2F76A3CA1962E61 --renderer-client-id=6 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4948
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=63F28E11F77CB04F85E13A0C8CF079CE --mojo-platform-channel-handle=2676 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 316742292960a70719c04d96e2af65a0985b53c71f9d534fe5905fa6386c9d42
MD5 46ee0e5088b96634f7522881aed37740
SHA1 3291de2735e3dff058b98c4462af54d0d985a98a
SHA512 9cc311e6905f1c6573211ff0ac45f60c37643099e0bef91cbbdec8fec0f955192642108f5c3a2564d0d805d0f34e962599bc407058c18713e89f5386760fc899
SSDEEP 384:yeMdThP0tELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:20+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download